CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free dans le pilote http.sys CVE-2022-21907 - Double Free dans le pilote http.sys Résumé Un attaquant non authentifié peut envoyer une requête HTTP avec un en-tête de requête HTTP « Accept-Encoding » déclenchant un double free dans la liste de codages inconnus de la pile d...

cve-2022-21907

CVE-2022-21907 Application Golang par 1vere$k CVE-2022-21907 - Double Free dans le pilote http.sys. Résumé Il s'agit d'une application Golang multithread qui permet d'envoyer des requêtes sur plusieurs cibles simultanément. Peu efficace avec les requêtes POST, mais elle offre près de 30 % de...

CVE-2021-31166

CVE-2021-31166 Détection des tentatives d'exploitation de CVE-2021-31166 vulnérabilité de la pile de protocole HTTP Règle Suricata Paquet Zeek Références https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/...

CVE-2021-31166

CVE-2021-31166 왜 최근에 CVE-2021-31166에 대한 익스플로잇을 작성했습니다. 이 익스플로잇은 CVE-2021-31166을 악용합니다. 펜테스터는 https://github.com/mauricelambert/CVE-2021-31166 을 사용해야 하지만, SOC 팀에서는 취약점을 제대로 수정하기 위해 특정 취약점을 알아야 합니다. 그래서 이 익스플로잇을 작성했습니다. 설명 취약한 IIS 웹 서버를 공격하기 위해 순수 파이썬, 파워셸, 루비 스크립트와 메타스플로잇, nmap 모듈을 제공합니다 서버를 다운시키기...

EUVD-2026-18378

Rack has quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header...

UBUNTU-CVE-2026-34230

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

CVE-2026-34230 Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

Integer Overflow lead to DOS in handling Accept-Encoding header in API /v2/models/<model-name>/generate

This report is not public...

EUVD-2018-0581

Malware in sbrugna...

EUVD-2003-0833

Malware in sbrugna...

Incorrect Input Validation

Apache Traffic Server is vulnerable to Incorrect Input Validation. The vulnerability is caused due to Invalid Accept-Encoding header. This can lead to fail cache lookup and force forwarding requests...

The vulnerability of the Apache Traffic Server web server, related to insufficient input validation, allows attackers to execute arbitrary requests.

The vulnerability of the Apache Traffic Server web server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary requests using the HTTP Accept-Encoding header...

DEBIAN-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

UBUNTU-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

PT-2024-5532 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4 Description: The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary requests using the HTTP...

GHSA-CQJG-WHMM-8GV6 Denial of Service via malformed accept-encoding header in hapi

Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved. Recommendation Update to version 16.1.1 or later...

Denial Of Service (DoS)

hapi is vulnerable to denial of service DoS attacks. A malicious user can send a malicious accept-encoding header to the system that causes the library to crash or the client to hang until the timeout period is reached...